CVE-2020-15078

OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

• CWE-305
• CWE-306

• https://community.openvpn.net/openvpn/wiki/CVE-2020-15078Patch, Vendor Advisory
• https://community.openvpn.net/openvpn/wiki/SecurityAnnouncementsBroken Link
• https://lists.debian.org/debian-lts-announce/2022/05/msg00002.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/
• https://security.gentoo.org/glsa/202105-25Third Party Advisory
• https://usn.ubuntu.com/usn/usn-4933-1Third Party Advisory
• https://community.openvpn.net/openvpn/wiki/CVE-2020-15078Patch, Vendor Advisory
• https://community.openvpn.net/openvpn/wiki/SecurityAnnouncementsBroken Link
• https://lists.debian.org/debian-lts-announce/2022/05/msg00002.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GJUXEYHUPREEBPX23VPEKMFXUPVO3PMU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGEGLC4YGBDN5CGHTNWN2GH6DJJA36T2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLDB3OBQ3AODYYRN7NRCABV6I4AUFAT6/
• https://security.gentoo.org/glsa/202105-25Third Party Advisory
• https://usn.ubuntu.com/usn/usn-4933-1Third Party Advisory

Published

Apr 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15072An issue was discovered in phpList through 3.5.4. An error-b…8.8
• CVE-2020-15073An issue was discovered in phpList through 3.5.4. An XSS vul…5.4
• CVE-2020-15074OpenVPN Access Server older than version 2.8.4 and version 2…7.5
• CVE-2020-15075OpenVPN Connect installer for macOS version 3.2.6 and older …7.1
• CVE-2020-15076Private Tunnel installer for macOS version 3.0.1 and older v…7.8
• CVE-2020-15077OpenVPN Access Server 2.8.7 and earlier versions allows a re…5.3
• CVE-2020-15079In PrestaShop from version 1.5.0.0 and before version 1.7.6.…5.4
• CVE-2020-1508<p>A remote code execution vulnerability exists when Windows…7.6
• CVE-2020-15080In PrestaShop from version 1.7.4.0 and before version 1.7.6.…5.3
• CVE-2020-15081In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there…5.3
• CVE-2020-15082In PrestaShop from version 1.6.0.1 and before version 1.7.6.…8.8
• CVE-2020-15083In PrestaShop from version 1.7.0.0 and before version 1.7.6.…6.1